Controller
Hausarzt Praxis - Beispielstadt, Bauerngasse 16, 86956 Schongau (Phone 01234567890).
What we process your data for
To carry out your medical treatment, including documentation, organisation and billing. The legal bases are the treatment contract (Sections 630a et seq. German Civil Code) and Art. 6(1)(b) and (c), Art. 9(2)(h) GDPR in conjunction with Section 22 German Federal Data Protection Act (BDSG); for statutorily insured patients additionally the provisions of the German Social Code Book V (SGB V). For anything beyond this we ask for your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR).
Who receives your data
Only where required by law or permitted by you: e.g. your health insurance fund and the Association of Statutory Health Insurance Physicians (or Dentists) for billing, laboratories as part of test orders, co-treating doctors (with your consent or where necessary for your treatment), and for private treatment a billing office where applicable (only with your consent). Service providers who support us technically (e.g. practice software, hosting) are contractually bound to confidentiality (Art. 28 GDPR).
Electronic patient record
If you have statutory health insurance and have not objected to the electronic patient record (ePA), we are legally obliged to enter certain treatment data there. You can object with your health insurance fund and – for individual documents – also with us.
How long we store your data
We keep your patient record for at least ten years after the end of treatment (Section 630f(3) German Civil Code). Longer statutory periods apply to certain documents, e.g. X-rays under radiation protection law. After that the data is deleted.
Your rights
You have the right to access and obtain a copy of your data (Art. 15 GDPR, Section 630g German Civil Code), rectification (Art. 16), erasure where there is no obligation to retain (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and withdrawal of consents given with effect for the future (Art. 7(3)). You can lodge a complaint with a data protection supervisory authority, e.g. that of the federal state in which the practice is located.
Do you have to provide your data?
Without the information required for treatment we generally cannot treat you. Voluntary information and consents are marked as such.
